Paths/Claude Engineer/Keeping Claude Code Safe / Permissions & Secrets
Set the Permission Set
Every command the agent may run without asking is a decision you make once. Write the permission set for your repository.
Validator
IDLE — checks run live as you type commands; submit when done
01Requirements
live checks- File ~/.claude/security/permissions.md exists○
- The document lists the commands allowed without approval○
- The document lists the commands that always need a human○
02Walkthrough
3 steps- 01
Create the security directory
The permission set is part of the setup, so it is written down and reviewed.
mkdir -p ~/.claude/security - 02
Write the allow and the ask lists
Allow the read only commands and the test suite. Ask for anything that writes, and deny the destructive ones outright.
echo '# Permissions\n\n## Allow without asking\n\n- read only commands - cat, ls, grep, git status, git log\n- the build, the type check and the test suite\n- writing inside the working tree\n\n## Always ask\n\n- installing anything\n- anything outside the working tree\n- git push, and every deploy\n\n## Deny\n\n- rm with a recursive flag, and anything that rewrites history' > ~/.claude/security/permissions.md - 03
Verify and submit
cat the permission set, then submit for validation.
cat ~/.claude/security/permissions.md
03Stuck?
0 of 3 revealedTake a hint without losing the lab — each one points at the thing to look at, not at the answer.
04AI Tutor
guides, never solvesTell me what you're stuck on — I'll nudge, not solve. Which requirement are you looking at?
04Notebook
saved locally in this browserlearner@lab — ubuntu:24.04
Session is disposable
↑/↓ recalls commands · Ctrl+Enter submits · type help for the command list